The background art includes systems where the computer code being attacked is a database. Such systems are called database intrusion detection systems. Some of these systems utilize offline non-real-time training in order to detect suspicious or anomalous activity. These systems use database log files external to the database, or audit tables internal to the database, in conjunction with the training. Since these database intrusion detection systems are trained during normal usage of the database, the amount of logged data may be extensive—potentially many gigabytes in size over the course of the training. Requiring the system administrator to collect multiple gigabytes of logged data to train the system is expensive in terms of storage needs, and requires constant monitoring by the system administrator to ensure that the logged entries do not fill up the storage area of the computer used for the training. In addition, many database systems override older logged entries when the number of entries exceeds a pre-allocated storage limit. This causes entries to be overwritten and thus lost before training can occur. Furthermore, if the audit logs are stored within the database itself (to be used later during an operational step), such storage uses up valuable resources on the database and negatively impacts the database's performance.
Examples of offline non-real-time database intrusion detection systems are described in Lee, et al., “Learning Fingerprints for a Database Intrusion Detection System”, ESORICS 2002, pp. 264-279, published in November 2002 by Springer-Verlag, Berlin and Heidelberg, Germany; and C. Chung, et al., “DEMIDS: A Misuse Detection System for Database Systems”, Department of Computer Science, University of California at Davis, Davis, Calif., Oct. 1, 1999.